From 1fa9dc18abd0e0cf3a4b73b6ccfa1e104c38df98 Mon Sep 17 00:00:00 2001
From: codex <bernd.worsch@gmail.com>
Date: Tue, 25 Aug 2026 20:05:21 +0200
Subject: [PATCH] fix(workplans): adopt ADR-007 derived identifiers for
 unregistered records

These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
---
 ...TY-WP-0020-weekly-forgejo-package-prune.md | 16 +++++++-------
 ...ITY-WP-0021-prod-automation-reliability.md | 20 ++++++++---------
 ...TY-WP-0022-issuesink-no-default-forgejo.md | 10 ++++-----
 ...TIVITY-WP-0023-intent-scope-gap-closure.md | 22 +++++++++----------
 ...ITY-WP-0024-operator-automation-console.md | 20 ++++++++---------
 .../ACTIVITY-WP-0025-ops-ui-sso-access.md     | 18 +++++++--------
 .../ACTIVITY-WP-0026-ops-run-claim-queue.md   | 16 +++++++-------
 ...Y-WP-0027-llm-connect-and-run-artifacts.md | 18 +++++++--------
 .../ACTIVITY-WP-0028-activity-review-cli.md   | 16 +++++++-------
 .../ACTIVITY-WP-0029-hub-port-alignment.md    | 10 ++++-----
 .../ACTIVITY-WP-0030-daily-sbom-catchup.md    | 10 ++++-----
 11 files changed, 88 insertions(+), 88 deletions(-)

diff --git a/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md b/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md
index 99aea2c..bba50fc 100644
--- a/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md
+++ b/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md
@@ -9,7 +9,7 @@ owner: codex
 topic_slug: activity-core
 created: "2026-07-12"
 updated: "2026-07-21"
-state_hub_workstream_id: "33a5b5e0-310c-442e-a29f-902227b9d7e1"
+state_hub_workstream_id: "5e74cce7-9ffd-5f9a-89e9-17faf55c1ba9"
 ---
 
 # Weekly Forgejo package prune (retain 3 versions)
@@ -88,7 +88,7 @@ workplans, or activity-definition files. Runtime token file path only.
 id: ACTIVITY-WP-0020-T01
 status: done
 priority: high
-state_hub_task_id: "d4212ce4-9292-4c56-abcd-952e0c1bbab7"
+state_hub_task_id: "d86bdea5-e41a-590c-99e1-1fe84d6760e3"
 ```
 
 Add canonical retention prose to:
@@ -112,7 +112,7 @@ without reading source.
 id: ACTIVITY-WP-0020-T02
 status: done
 priority: high
-state_hub_task_id: "3abec46e-fca8-4583-b681-c0836e0bf666"
+state_hub_task_id: "ef1eb392-5338-54eb-b2fe-f68218cf33e8"
 ```
 
 In `railiance-platform`:
@@ -141,7 +141,7 @@ Acceptance: dry-run against production lists candidates; no deletes without
 id: ACTIVITY-WP-0020-T03
 status: done
 priority: high
-state_hub_task_id: "f8c6eb1a-2682-49b0-a6ab-e96c8174f75f"
+state_hub_task_id: "9f4f6ffd-ed9e-52b2-a59a-7e148e8b5a96"
 ```
 
 In `activity-core`, extend the `shell` context resolver (same pattern as
@@ -165,7 +165,7 @@ exit and stderr snippet (truncated, no secrets).
 id: ACTIVITY-WP-0020-T04
 status: done
 priority: high
-state_hub_task_id: "2da2ca5d-1c59-4835-b48e-7bf3bfae97b4"
+state_hub_task_id: "b80326c0-3ce0-571e-ab38-29125a75d3c5"
 ```
 
 Add `activity-definitions/weekly-forgejo-package-prune.md`:
@@ -203,7 +203,7 @@ Acceptance: definition parses via `sync-definitions`; schedule id derivable from
 id: ACTIVITY-WP-0020-T05
 status: done
 priority: medium
-state_hub_task_id: "debc74f0-d43d-401e-b65f-c6dbb5b399d7"
+state_hub_task_id: "f3b907de-0900-534f-872f-92950f260726"
 ```
 
 2026-07-12: Implementation landed (script, resolver, activity-definition,
@@ -242,7 +242,7 @@ this host. Enable/apply gated on **T07** (extend protection to live deployed tag
 id: ACTIVITY-WP-0020-T07
 status: done
 priority: high
-state_hub_task_id: "59cd05b3-1a26-4935-9131-0e4d746cb984"
+state_hub_task_id: "9da65260-c785-56db-864e-e8a965dc89ab"
 ```
 
 The Helm-values protection scan under-covers: it only protected 1 tag, missing
@@ -305,7 +305,7 @@ next activity-core image deploy or the external-definitions configmap)
 id: ACTIVITY-WP-0020-T06
 status: done
 priority: medium
-state_hub_task_id: "600c7b22-9278-430b-9cba-902acb5c279a"
+state_hub_task_id: "99f11d58-9dee-5ee8-9b62-9d410fa0274a"
 ```
 
 After T05 approval, run one manual `make forgejo-package-prune` with `--apply`
diff --git a/workplans/ACTIVITY-WP-0021-prod-automation-reliability.md b/workplans/ACTIVITY-WP-0021-prod-automation-reliability.md
index fcf21f3..cb5bef8 100644
--- a/workplans/ACTIVITY-WP-0021-prod-automation-reliability.md
+++ b/workplans/ACTIVITY-WP-0021-prod-automation-reliability.md
@@ -9,7 +9,7 @@ owner: codex
 topic_slug: activity-core
 created: "2026-07-21"
 updated: "2026-07-21"
-state_hub_workstream_id: "1ca89384-0382-4576-a635-a244862fa019"
+state_hub_workstream_id: "0459be51-9636-53f4-8560-c99609b13fad"
 ---
 
 # Production automation reliability after Sunday–Monday fire review
@@ -73,7 +73,7 @@ Restore **observable, successful scheduled outcomes** on railiance01:
 id: ACTIVITY-WP-0021-T01
 status: done
 priority: high
-state_hub_task_id: "dfbe005f-eeca-4c70-9e2b-4be5344b9c36"
+state_hub_task_id: "bdd9520f-1f38-5d1b-93fa-ba4b9c917080"
 ```
 
 **Why first:** Shared failure mode for Binky daily, Binky mail, SBOM weekly, and
@@ -104,7 +104,7 @@ away from IssueSink with a successful alternative sink).
 id: ACTIVITY-WP-0021-T02
 status: done
 priority: high
-state_hub_task_id: "d8bdd7bb-6792-4ad7-a986-de0ace6998ba"
+state_hub_task_id: "290a04c4-6008-57b8-9c01-c08e6548ce08"
 ```
 
 Depends on T01 if Binky still uses IssueSink/task emission.
@@ -132,7 +132,7 @@ are recorded after T01, with links/IDs in this workplan or a progress event.
 id: ACTIVITY-WP-0021-T03
 status: done
 priority: high
-state_hub_task_id: "1c28cef5-2f5d-40c8-80cd-23c9b7954855"
+state_hub_task_id: "e3741cbe-90ab-5c69-afda-67760863fec8"
 ```
 
 Mon 2026-07-20 07:00 UTC SBOM fire **FAILED** after resolver work when
@@ -155,7 +155,7 @@ readable evidence (not only a Temporal COMPLETED with silent failure).
 id: ACTIVITY-WP-0021-T04
 status: done
 priority: high
-state_hub_task_id: "87012f92-1813-4aed-8bb2-1bc5aeb8523d"
+state_hub_task_id: "243636eb-5dcb-524b-b8de-5c3c55629cd8"
 ```
 
 1. **Template gap:** locate or add
@@ -180,7 +180,7 @@ SLO in the task closeout).
 id: ACTIVITY-WP-0021-T05
 status: done
 priority: medium
-state_hub_task_id: "9e4b31a4-49d9-4268-922c-84934b914509"
+state_hub_task_id: "7917ce6c-4f2f-5945-8457-83126cc63ecf"
 ```
 
 Sun+Mon 2026-07-19/20 triage runs **completed** (`run_id` present,
@@ -206,7 +206,7 @@ Sun+Mon 2026-07-19/20 triage runs **completed** (`run_id` present,
 id: ACTIVITY-WP-0021-T06
 status: done
 priority: medium
-state_hub_task_id: "a14351bc-dbc2-40b0-a4ed-293c5b0f66f2"
+state_hub_task_id: "f3a796db-b5bf-5d25-a325-8cb088641afc"
 ```
 
 Tracks TD **f29e49eb** (registered 2026-07-20): reconcile aborts mid-loop when
@@ -226,7 +226,7 @@ TD f29e49eb marked resolved or linked to this task closeout.
 id: ACTIVITY-WP-0021-T07
 status: done
 priority: medium
-state_hub_task_id: "b0c80183-cf64-4fc7-b572-0a6568b2e0aa"
+state_hub_task_id: "21756b7c-35d7-513f-bacd-f1e8704b157e"
 ```
 
 Observed on 2026-07-21: `actcore-app-db` ~384 restarts, `actcore-temporal-db`
@@ -249,7 +249,7 @@ explicit blocked handoff (issue/workplan in owning repo) with severity.
 id: ACTIVITY-WP-0021-T08
 status: done
 priority: low
-state_hub_task_id: "3e3aef91-2c06-49cc-8d83-293f65ebda22"
+state_hub_task_id: "550033a9-96b0-5201-976e-a8e814189329"
 ```
 
 Workstation `make automation-status SINCE=sunday` reported all key activities
@@ -270,7 +270,7 @@ reproduces the Sunday review without inventing credentials.
 id: ACTIVITY-WP-0021-T09
 status: done
 priority: medium
-state_hub_task_id: "f02a00b4-d75a-48a4-b9ef-4da5aff2442d"
+state_hub_task_id: "fc73fbef-be13-5ce3-be02-715bffb4d1db"
 ```
 
 After T01–T06 (and T07 if unblocked):
diff --git a/workplans/ACTIVITY-WP-0022-issuesink-no-default-forgejo.md b/workplans/ACTIVITY-WP-0022-issuesink-no-default-forgejo.md
index 5c39a45..db6919b 100644
--- a/workplans/ACTIVITY-WP-0022-issuesink-no-default-forgejo.md
+++ b/workplans/ACTIVITY-WP-0022-issuesink-no-default-forgejo.md
@@ -9,7 +9,7 @@ owner: codex
 topic_slug: activity-core
 created: "2026-07-21"
 updated: "2026-07-21"
-state_hub_workstream_id: "d8e4a0c0-dc63-486b-b153-0292e63dba54"
+state_hub_workstream_id: "6871d26b-6eaf-5a7e-94d1-e5cf8f2e2c7a"
 ---
 
 # IssueSink: stop default silent Forgejo issues for internal findings
@@ -65,7 +65,7 @@ create Forgejo issues for internal findings.
 id: ACTIVITY-WP-0022-T01
 status: done
 priority: high
-state_hub_task_id: "1a0d9bf6-c822-42c8-9b67-8a9be16cce7d"
+state_hub_task_id: "44f224bc-50db-5830-8f13-3b5495698eb9"
 ```
 
 Choose and document:
@@ -84,7 +84,7 @@ and ISSUE-WP-0004 origin.
 id: ACTIVITY-WP-0022-T02
 status: done
 priority: high
-state_hub_task_id: "78f994f6-68bd-4f18-88b0-3a25b46e7563"
+state_hub_task_id: "a11fdab2-c7fc-52b7-9723-d6ec920b0608"
 ```
 
 Code + config changes so unmatched / internal-finding paths cannot spam
@@ -97,7 +97,7 @@ Forgejo. Update tests (`tests/test_issue_sink.py` and callers of
 id: ACTIVITY-WP-0022-T03
 status: done
 priority: medium
-state_hub_task_id: "d45f861d-4c5e-4721-8e02-50d7deafaefd"
+state_hub_task_id: "271189a4-fbc2-52c4-9fae-47c5bd430f2a"
 ```
 
 At minimum: `daily-todo-md-stale-review` and any other definition that only
@@ -111,7 +111,7 @@ paused.
 id: ACTIVITY-WP-0022-T04
 status: done
 priority: medium
-state_hub_task_id: "747a19ab-c6a5-4f8a-b294-a8dc0f82109f"
+state_hub_task_id: "eeac1e4f-ae47-589f-8a5a-337ef3de7052"
 ```
 
 Document sink matrix; audit railiance01 / compose env for
diff --git a/workplans/ACTIVITY-WP-0023-intent-scope-gap-closure.md b/workplans/ACTIVITY-WP-0023-intent-scope-gap-closure.md
index 1c8ff04..d2b081f 100644
--- a/workplans/ACTIVITY-WP-0023-intent-scope-gap-closure.md
+++ b/workplans/ACTIVITY-WP-0023-intent-scope-gap-closure.md
@@ -9,7 +9,7 @@ owner: codex
 topic_slug: activity-core
 created: "2026-07-21"
 updated: "2026-07-21"
-state_hub_workstream_id: "26f253f4-c9c5-4772-a3d9-2b0fa8e4d198"
+state_hub_workstream_id: "1e3dbc2b-4574-51c9-8a10-9effc074ed14"
 ---
 
 # Intent–scope gap closure and WP-0020/0021 operational follow-ups
@@ -64,7 +64,7 @@ note — so SCOPE stays truthful and INTENT’s three questions remain load-bear
 id: ACTIVITY-WP-0023-T01
 status: done
 priority: high
-state_hub_task_id: "144197ee-5ed1-40be-b4fe-ba5683fc0579"
+state_hub_task_id: "7aa0f8e4-4fc6-53a7-acc4-2fc6efd91fb0"
 ```
 
 **Depends on ACTIVITY-WP-0022-T01** (default sink policy decision).
@@ -86,7 +86,7 @@ tasks for docs/defaults are cross-linked as done.
 id: ACTIVITY-WP-0023-T02
 status: done
 priority: high
-state_hub_task_id: "fbfd3796-736a-4b75-a391-20ce29eeca48"
+state_hub_task_id: "73bcb69f-198e-52fa-9703-9f8b8274e2bc"
 ```
 
 INTENT: execution lives in per-repo workers / harness — not activity-core.
@@ -108,7 +108,7 @@ INTENT: execution lives in per-repo workers / harness — not activity-core.
 id: ACTIVITY-WP-0023-T03
 status: done
 priority: medium
-state_hub_task_id: "7626820e-f823-4d20-936d-1aecc2828caf"
+state_hub_task_id: "537a08cd-540b-5146-90ce-63ca0b5b9d23"
 ```
 
 1. Codify in runbook which shell queries may set `apply: true` (today: Forgejo
@@ -126,7 +126,7 @@ source; docs list allowed side-effect definitions.
 id: ACTIVITY-WP-0023-T04
 status: done
 priority: medium
-state_hub_task_id: "50945834-b005-4010-9dc7-6abf071b6aa8"
+state_hub_task_id: "d73a5581-4a80-58f8-8956-fa48fd69924d"
 ```
 
 Non-blocking follow-up from ACTIVITY-WP-0020.
@@ -146,7 +146,7 @@ runbook links it from the prune section.
 id: ACTIVITY-WP-0023-T05
 status: done
 priority: medium
-state_hub_task_id: "bf21fa27-a872-44a6-a87b-1fe69018d090"
+state_hub_task_id: "3074a57a-5221-5ab0-8e05-80df1a2a3514"
 ```
 
 1. OpenBao / railiance-platform: grant activity-core ESO token read on
@@ -172,7 +172,7 @@ working token without manual patch.
 id: ACTIVITY-WP-0023-T06
 status: done
 priority: low
-state_hub_task_id: "7232d5a3-c7a8-4fdf-aaef-5daab0ea92b1"
+state_hub_task_id: "a9318c37-6852-5e0c-9cf5-940b78fd73a8"
 ```
 
 Non-blocking follow-up from ACTIVITY-WP-0021.
@@ -198,7 +198,7 @@ flip rest until issue-core proves 201. Documented in
 id: ACTIVITY-WP-0023-T07
 status: done
 priority: medium
-state_hub_task_id: "eeb4beb9-8184-4ae3-95cd-d27dc88e7973"
+state_hub_task_id: "5519c172-a4f1-5113-8520-fbdbca8351fe"
 ```
 
 1. Coordinate with state-hub image: ship MarkiTect / set
@@ -224,7 +224,7 @@ message filed. SCOPE G6 notes residual external.
 id: ACTIVITY-WP-0023-T08
 status: done
 priority: low
-state_hub_task_id: "17b863e9-955a-402e-ba20-a5189556e21d"
+state_hub_task_id: "a8a418d9-c641-54b8-99b0-d3b5a2ae8314"
 ```
 
 1. Decide: remove registration from worker, or rename/document as
@@ -240,7 +240,7 @@ state_hub_task_id: "17b863e9-955a-402e-ba20-a5189556e21d"
 id: ACTIVITY-WP-0023-T09
 status: done
 priority: low
-state_hub_task_id: "24bbf6eb-bf83-4d99-9a2a-0e207ead59c0"
+state_hub_task_id: "ddac25b8-9b42-5122-b2a3-5c00eb0bb5e2"
 ```
 
 1. Document that `review_required` is metadata-only until issue-core or
@@ -256,7 +256,7 @@ state_hub_task_id: "24bbf6eb-bf83-4d99-9a2a-0e207ead59c0"
 id: ACTIVITY-WP-0023-T10
 status: done
 priority: low
-state_hub_task_id: "05b3e280-da88-45da-833e-3bd4ee5eaea3"
+state_hub_task_id: "e29a9c5b-4829-527e-91b3-26adf111d397"
 ```
 
 1. Document in runbook: prod progress is on railiance01 state-hub/edge; use
diff --git a/workplans/ACTIVITY-WP-0024-operator-automation-console.md b/workplans/ACTIVITY-WP-0024-operator-automation-console.md
index f59e793..3173fc7 100644
--- a/workplans/ACTIVITY-WP-0024-operator-automation-console.md
+++ b/workplans/ACTIVITY-WP-0024-operator-automation-console.md
@@ -9,7 +9,7 @@ owner: codex
 topic_slug: activity-core
 created: "2026-07-21"
 updated: "2026-07-21"
-state_hub_workstream_id: "2e15fa3b-3210-4a7c-82f1-f28f12a2d3c7"
+state_hub_workstream_id: "555c6bb2-73e2-579b-837b-a7df0daad621"
 ---
 
 # Operator automation console (status API + control plane + thin UI)
@@ -109,7 +109,7 @@ Deep-links into State Hub / edge when evidence lives there (G9-aware).
 id: ACTIVITY-WP-0024-T01
 status: done
 priority: high
-state_hub_task_id: "d8830c31-bbcd-41d4-b74b-e1632d8d0257"
+state_hub_task_id: "697113b1-793e-59b4-a86c-ecb22ad127b6"
 ```
 
 1. Write a short product brief (personas, jobs-to-be-done, non-goals) in this
@@ -126,7 +126,7 @@ state_hub_task_id: "d8830c31-bbcd-41d4-b74b-e1632d8d0257"
 id: ACTIVITY-WP-0024-T02
 status: done
 priority: high
-state_hub_task_id: "a94decc6-8ac9-4738-823a-6c7b19dade80"
+state_hub_task_id: "0e709610-2599-593c-9341-1ca5b6ddd23e"
 ```
 
 1. Design operator token check (e.g. `X-Operator-Token` header compared to
@@ -145,7 +145,7 @@ runbook describes custody without leaking secrets.
 id: ACTIVITY-WP-0024-T03
 status: done
 priority: high
-state_hub_task_id: "ed665a54-0a5c-4d35-b47d-50de77ef91d6"
+state_hub_task_id: "8adf73b7-d23e-5110-8dc4-a22fc0bde448"
 ```
 
 1. `GET /ops/automations` — inventory equivalent to WP-0019 (cron/scheduled defs,
@@ -165,7 +165,7 @@ window within documented field mapping.
 id: ACTIVITY-WP-0024-T04
 status: done
 priority: high
-state_hub_task_id: "720e0783-93b8-480a-8bfb-00a6aae592a1"
+state_hub_task_id: "26d50f76-67cc-5719-a94a-b2de9c1a1495"
 ```
 
 1. `GET /ops/automations/{id}/runs?since=` (and optional global runs list).
@@ -181,7 +181,7 @@ state_hub_task_id: "720e0783-93b8-480a-8bfb-00a6aae592a1"
 id: ACTIVITY-WP-0024-T05
 status: done
 priority: high
-state_hub_task_id: "2673bd8e-f746-428a-9a20-79336dcad9d4"
+state_hub_task_id: "aff1ddc5-4e78-5f6f-98da-2b2e0af5f2f9"
 ```
 
 1. `POST /ops/automations/{id}/trigger` — wrap existing trigger path; require
@@ -202,7 +202,7 @@ evidence; pause/disable visible in inventory/status; unauthenticated mutate fail
 id: ACTIVITY-WP-0024-T06
 status: done
 priority: high
-state_hub_task_id: "8b10eb8f-90d1-498b-a0a3-5444c590a691"
+state_hub_task_id: "0c07917b-b195-5cbe-a739-bd3a1ae752bb"
 ```
 
 1. Contract tests for inventory/status/runs JSON shapes.
@@ -217,7 +217,7 @@ state_hub_task_id: "8b10eb8f-90d1-498b-a0a3-5444c590a691"
 id: ACTIVITY-WP-0024-T07
 status: done
 priority: medium
-state_hub_task_id: "32c695ac-f208-4540-b2fa-199a3f83c4c9"
+state_hub_task_id: "d2002e29-a1c5-54ff-b2a8-e63db7fe22bb"
 ```
 
 1. Static/HTMX (or minimal SPA) served from actcore-api under `/ops/ui/`.
@@ -234,7 +234,7 @@ state_hub_task_id: "32c695ac-f208-4540-b2fa-199a3f83c4c9"
 id: ACTIVITY-WP-0024-T08
 status: done
 priority: medium
-state_hub_task_id: "032f7485-3cf6-4ec2-a076-cbf82312a63c"
+state_hub_task_id: "3b595a46-38e0-51e1-bfee-814de684f8f5"
 ```
 
 1. Document port-forward (or equivalent) for railiance01.
@@ -252,7 +252,7 @@ still deferred with a clear follow-up note.
 id: ACTIVITY-WP-0024-T09
 status: done
 priority: low
-state_hub_task_id: "1a937c1a-6534-467e-94fb-8ba54e18236e"
+state_hub_task_id: "36a3cac3-388b-5f58-94ca-814e494d08f3"
 ```
 
 1. Map “How did automations go since Sunday?” to `/ops/automations/status` and UI.
diff --git a/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md b/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md
index a23875d..1383ca0 100644
--- a/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md
+++ b/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md
@@ -9,7 +9,7 @@ owner: codex
 topic_slug: activity-core
 created: "2026-07-22"
 updated: "2026-07-22"
-state_hub_workstream_id: "c4e48358-df12-4bf4-9916-0e93f05f5fcf"
+state_hub_workstream_id: "347cad20-d66c-5151-b577-50eb93a85023"
 ---
 
 # SSO access control for ops console and Temporal UI
@@ -83,7 +83,7 @@ git or State Hub.
 id: ACTIVITY-WP-0025-T01
 status: done
 priority: high
-state_hub_task_id: "de28ac08-cae5-476b-b093-82fcf8e3fa5e"
+state_hub_task_id: "44899e72-0481-5cd2-baa9-b96a547e4cd2"
 ```
 
 1. Document intended audience (founders / operators), MFA expectation, and
@@ -102,7 +102,7 @@ hostnames and IdP group named.
 id: ACTIVITY-WP-0025-T02
 status: done
 priority: high
-state_hub_task_id: "650db102-ad4e-4d8e-86c1-eee50f5bafcc"
+state_hub_task_id: "b48ff4e4-bf85-54f5-a107-aa247e9fc625"
 ```
 
 1. Find an existing oauth2-proxy / OIDC ingress pattern on railiance01 or
@@ -118,7 +118,7 @@ state_hub_task_id: "650db102-ad4e-4d8e-86c1-eee50f5bafcc"
 id: ACTIVITY-WP-0025-T03
 status: done
 priority: high
-state_hub_task_id: "7084f7d5-4181-4dfa-b239-0dad15efbae9"
+state_hub_task_id: "58c8e105-e73a-5417-b8b9-d0dc64b20194"
 ```
 
 1. Add Ingress (or Gateway) for `actcore-api` serving at least `/ops` and
@@ -136,7 +136,7 @@ port-forward; unauthorized gets login or 403.
 id: ACTIVITY-WP-0025-T04
 status: done
 priority: high
-state_hub_task_id: "99b36f31-eb19-4f96-b3f1-9ac1ab02d78f"
+state_hub_task_id: "99f56e9a-6a5a-5fe9-a4c4-4a497a5c256e"
 ```
 
 1. Expose `actcore-temporal-ui` behind the same auth edge (hostname or path).
@@ -153,7 +153,7 @@ port-forward, under SSO.
 id: ACTIVITY-WP-0025-T05
 status: done
 priority: high
-state_hub_task_id: "77fff202-bfb6-49eb-b8e5-3760abacc8bd"
+state_hub_task_id: "7d948dc6-374e-59ac-a6c9-e7fa6e8a128b"
 ```
 
 1. Accept trusted identity from the auth edge (e.g. `X-Forwarded-User` /
@@ -172,7 +172,7 @@ token not required for normal operator use.
 id: ACTIVITY-WP-0025-T06
 status: done
 priority: medium
-state_hub_task_id: "b14e1f2c-1320-4218-8bd3-2a309295a69c"
+state_hub_task_id: "a8354b03-2e43-5fe1-8d40-4a39502d9090"
 ```
 
 1. Register OIDC client(s) via key-cape / netkingdom process (not ad-hoc).
@@ -195,7 +195,7 @@ Authelia domain allow/deny for both public hosts, membership runbook
 id: ACTIVITY-WP-0025-T07
 status: done
 priority: medium
-state_hub_task_id: "c5945e64-c460-4830-a19e-a944bb44a67e"
+state_hub_task_id: "4cfe1761-9bc4-58d1-bd0b-b0112230344a"
 ```
 
 1. Runbook: primary access = SSO URLs; port-forward = break-glass only.
@@ -210,7 +210,7 @@ state_hub_task_id: "c5945e64-c460-4830-a19e-a944bb44a67e"
 id: ACTIVITY-WP-0025-T08
 status: done
 priority: medium
-state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
+state_hub_task_id: "a3bddd50-deec-5e72-9311-02694d0fc2dc"
 ```
 
 1. Confirm ClusterIP APIs without Ingress path remain not publicly reachable.
diff --git a/workplans/ACTIVITY-WP-0026-ops-run-claim-queue.md b/workplans/ACTIVITY-WP-0026-ops-run-claim-queue.md
index 209e4da..a0568fd 100644
--- a/workplans/ACTIVITY-WP-0026-ops-run-claim-queue.md
+++ b/workplans/ACTIVITY-WP-0026-ops-run-claim-queue.md
@@ -18,7 +18,7 @@ related:
   - REIN-A-0002
   - ISSUE-WP-0006
   - STATE-WP-0078
-state_hub_workstream_id: "c8f1eaa3-6d1a-4002-bb1f-fc250ed353fe"
+state_hub_workstream_id: "d05e49dd-dbc9-59f4-bbc8-8bfced64d4a8"
 ---
 
 # ACTIVITY-WP-0026 — Ops run claim queue
@@ -56,7 +56,7 @@ Temporal schedule / trigger
 id: ACTIVITY-WP-0026-T01
 status: done
 priority: high
-state_hub_task_id: "d2f92ac2-d900-43d8-83ae-62e77d7467d4"
+state_hub_task_id: "7e284d2e-09d4-53c3-88ab-88ac1ded033b"
 ```
 
 Document in `docs/ops-run-queue.md`:
@@ -99,7 +99,7 @@ service credential for harness, SSO for humans later).
 id: ACTIVITY-WP-0026-T02
 status: done
 priority: high
-state_hub_task_id: "65d0d28f-0be6-4ae5-9e12-a051ccebbb36"
+state_hub_task_id: "fd0444bd-1062-54d5-b250-1aa275b82c44"
 ```
 
 Alembic migration for `ops_runs` (+ indexes on `state`, `lease_until`,
@@ -115,7 +115,7 @@ Alembic migration for `ops_runs` (+ indexes on `state`, `lease_until`,
 id: ACTIVITY-WP-0026-T03
 status: done
 priority: high
-state_hub_task_id: "1615936e-e0a4-4221-8b93-ec7938bd523b"
+state_hub_task_id: "50d4c22f-1674-5459-95f4-99e0a7592d18"
 ```
 
 On successful rule emit (internal fleet path):
@@ -139,7 +139,7 @@ Binky-style definitions; tests with mocked sink.
 id: ACTIVITY-WP-0026-T04
 status: done
 priority: high
-state_hub_task_id: "57cdd0ce-2d54-4148-89e2-9d89c33d7f8a"
+state_hub_task_id: "dce47143-c67b-5698-8c2e-c3e2697870c3"
 ```
 
 Implement claim with `SELECT … FOR UPDATE SKIP LOCKED` (or equivalent) and
@@ -156,7 +156,7 @@ lease TTL (config: e.g. 15m). Expire job or on-claim sweep: `claimed` past
 id: ACTIVITY-WP-0026-T05
 status: done
 priority: medium
-state_hub_task_id: "08f53f8b-6a17-4a21-9639-88f6924a7c1a"
+state_hub_task_id: "ef00ea27-e0f6-5451-abe1-655c1e224312"
 ```
 
 - Extend `/ops/automations/status` (or sibling) with open/claimed/failed counts.  
@@ -173,7 +173,7 @@ state_hub_task_id: "08f53f8b-6a17-4a21-9639-88f6924a7c1a"
 id: ACTIVITY-WP-0026-T06
 status: done
 priority: medium
-state_hub_task_id: "f8ca5ab8-3343-4edb-9ae8-fdbc90e17aae"
+state_hub_task_id: "9705d46d-4088-5d56-be27-2c0cc23c6806"
 ```
 
 Update:
@@ -193,7 +193,7 @@ Update:
 id: ACTIVITY-WP-0026-T07
 status: done
 priority: medium
-state_hub_task_id: "b1ce221b-edb2-42ed-91a1-e9f144a58d1e"
+state_hub_task_id: "962a22bf-4f18-58f8-bc0a-873f59916792"
 ```
 
 **Deploy notes:** [`docs/deploy-ops-run-queue-railiance.md`](../docs/deploy-ops-run-queue-railiance.md)
diff --git a/workplans/ACTIVITY-WP-0027-llm-connect-and-run-artifacts.md b/workplans/ACTIVITY-WP-0027-llm-connect-and-run-artifacts.md
index b588b7c..164340f 100644
--- a/workplans/ACTIVITY-WP-0027-llm-connect-and-run-artifacts.md
+++ b/workplans/ACTIVITY-WP-0027-llm-connect-and-run-artifacts.md
@@ -19,7 +19,7 @@ related:
   - REIN-A-0002
   - ACTIVITY-WP-0010
   - ACTIVITY-WP-0021
-state_hub_workstream_id: "f8957bc5-4047-407c-b17f-940179d63e17"
+state_hub_workstream_id: "bf348869-6e24-5034-a7b8-d2ce3266d5a0"
 ---
 
 # ACTIVITY-WP-0027 — Hardened llm-connect access + run→artifact links
@@ -157,7 +157,7 @@ Never put tokens in URLs.
 id: ACTIVITY-WP-0027-T01
 status: done
 priority: high
-state_hub_task_id: "516c35d3-fefd-46b6-a3a6-08767250ae4c"
+state_hub_task_id: "bab59b36-aeb6-58f0-9523-3ca1a71199c4"
 ```
 
 1. Inventory current railiance paths: claim-loop env, PF processes, in-cluster
@@ -178,7 +178,7 @@ vs railiance host unit) and acceptance tests listed.
 id: ACTIVITY-WP-0027-T02
 status: done
 priority: high
-state_hub_task_id: "2a877f37-a6ad-42af-bbff-71caf3b961ff"
+state_hub_task_id: "0afe72eb-51b1-5a00-82a3-4d29f406c322"
 ```
 
 Depends on T01.
@@ -201,7 +201,7 @@ old PF-only path marked deprecated.
 id: ACTIVITY-WP-0027-T03
 status: done
 priority: high
-state_hub_task_id: "7ebb6775-b3bb-4c26-945f-809dc2aea22c"
+state_hub_task_id: "369e8065-3f40-5dc9-a92a-bc1ce8acce25"
 ```
 
 1. Spec how `activity_runs` joins to `ops_runs` (by time window +
@@ -226,7 +226,7 @@ state_hub_task_id: "7ebb6775-b3bb-4c26-945f-809dc2aea22c"
 id: ACTIVITY-WP-0027-T04
 status: done
 priority: high
-state_hub_task_id: "093d1cd9-751b-4b19-bb42-1f4e105e992d"
+state_hub_task_id: "ac52322d-1688-51fd-a5b7-5e0ef565f550"
 ```
 
 Depends on T03.
@@ -255,7 +255,7 @@ alone after a successful claim.
 id: ACTIVITY-WP-0027-T05
 status: done
 priority: medium
-state_hub_task_id: "f9ef71a2-a0cf-4806-bb32-5233e0418ecd"
+state_hub_task_id: "01f34703-69c4-542d-b903-a5859717588b"
 ```
 
 Coordinate with rein-aharness (REIN-A follow-up or small patch in that repo):
@@ -278,7 +278,7 @@ links in ops UI without hand-editing DB rows.
 id: ACTIVITY-WP-0027-T06
 status: done
 priority: medium
-state_hub_task_id: "52f1db5e-23db-4dcd-aaba-71c11deaf09a"
+state_hub_task_id: "e76a0fb3-e4a7-5034-bb96-349ab15f5b0c"
 ```
 
 1. Inventory which `state-hub` resolvers **must** hard-fail vs may degrade
@@ -298,7 +298,7 @@ fixed or explicitly accepted with a follow-up id.
 id: ACTIVITY-WP-0027-T07
 status: done
 priority: low
-state_hub_task_id: "245955d4-83bd-4145-b71e-2e6449754e31"
+state_hub_task_id: "ae4e31d1-9fff-560d-8cfa-9877b1028b08"
 ```
 
 Depends on T02 (llm path solid) and proven claim-loop days for Binky.
@@ -316,7 +316,7 @@ Depends on T02 (llm path solid) and proven claim-loop days for Binky.
 id: ACTIVITY-WP-0027-T08
 status: done
 priority: high
-state_hub_task_id: "dc03e3b9-db4b-4d55-b262-01c8d46efe74"
+state_hub_task_id: "21c451e2-51f7-506a-9835-b82a74e8937f"
 ```
 
 Depends on T02 + T04 (minimum).
diff --git a/workplans/ACTIVITY-WP-0028-activity-review-cli.md b/workplans/ACTIVITY-WP-0028-activity-review-cli.md
index 28862b5..c46f6be 100644
--- a/workplans/ACTIVITY-WP-0028-activity-review-cli.md
+++ b/workplans/ACTIVITY-WP-0028-activity-review-cli.md
@@ -18,7 +18,7 @@ related:
   - ACTIVITY-WP-0019
   - ACTIVITY-WP-0021
   - ACT-ADR-005
-state_hub_workstream_id: "a405ce6a-2f1d-47b0-8ab8-85ae9cb8bfb2"
+state_hub_workstream_id: "1f99bf6f-5180-5e4e-b9a5-5137c48d84c4"
 ---
 
 # ACTIVITY-WP-0028 — `activity` CLI (repo-scoped automation review)
@@ -80,7 +80,7 @@ Canon: `docs/repo-automation-review-cli.md`.
 id: ACTIVITY-WP-0028-T01
 status: done
 priority: high
-state_hub_task_id: "9a780335-d97a-4c39-9845-7654d3bdf206"
+state_hub_task_id: "3c8117c1-81e9-5d92-9221-912350c308dc"
 ```
 
 1. Add `activity_core/review_cli/` package with `main()` argparse dispatcher.
@@ -103,7 +103,7 @@ consumer cwd in tests or documented local install.
 id: ACTIVITY-WP-0028-T02
 status: done
 priority: high
-state_hub_task_id: "c5ebb26f-2494-4fac-8540-d9a9d74e350b"
+state_hub_task_id: "38abf01c-fb20-5d7e-a878-2fb19a3fae2c"
 ```
 
 Depends on T01.
@@ -124,7 +124,7 @@ definition without API.
 id: ACTIVITY-WP-0028-T03
 status: done
 priority: high
-state_hub_task_id: "3e39e349-c43e-406a-b86d-f7dc704707c1"
+state_hub_task_id: "6f2be701-2738-5cd2-a1f9-eddb0062d403"
 ```
 
 Depends on T02.
@@ -144,7 +144,7 @@ Depends on T02.
 id: ACTIVITY-WP-0028-T04
 status: done
 priority: high
-state_hub_task_id: "a3203d03-5f6e-4ddf-875f-9d5c31ea9aeb"
+state_hub_task_id: "2f4ca8a7-498d-580f-8120-5810de366055"
 ```
 
 Depends on T03.
@@ -167,7 +167,7 @@ not “did not run”; exit `1` only on real failures.
 id: ACTIVITY-WP-0028-T05
 status: done
 priority: medium
-state_hub_task_id: "f687c2af-80ef-44f3-94da-5fb663b035c3"
+state_hub_task_id: "d1bdd871-2ede-5026-979b-a877c379fd03"
 ```
 
 Depends on T04.
@@ -190,7 +190,7 @@ and Forgejo/path artefacts without SSH.
 id: ACTIVITY-WP-0028-T06
 status: done
 priority: medium
-state_hub_task_id: "a6cd4704-1284-4859-8cee-3ea49aae4312"
+state_hub_task_id: "9a115c73-19c1-598e-9476-e91db33a02b1"
 ```
 
 Depends on T03 (docs can land with P1).
@@ -212,7 +212,7 @@ Depends on T03 (docs can land with P1).
 id: ACTIVITY-WP-0028-T07
 status: done
 priority: high
-state_hub_task_id: "84b090ce-168c-4c3b-9390-1de8a4d5f488"
+state_hub_task_id: "941e4662-5468-56c4-a07b-f2d71ced71a1"
 ```
 
 Depends on T04–T05.
diff --git a/workplans/ACTIVITY-WP-0029-hub-port-alignment.md b/workplans/ACTIVITY-WP-0029-hub-port-alignment.md
index 8dc9215..dc5b485 100644
--- a/workplans/ACTIVITY-WP-0029-hub-port-alignment.md
+++ b/workplans/ACTIVITY-WP-0029-hub-port-alignment.md
@@ -21,7 +21,7 @@ related:
   - STATE-WP-0079
   - CORE-WP-0010
   - SHR-ARCH-HUB-0001
-state_hub_workstream_id: "1b18849c-db3a-40a0-8f22-7af7fd4dbcfc"
+state_hub_workstream_id: "0890b1cf-fed0-5c5e-8f7a-d5799b997532"
 ---
 
 # Hub port and schedule alignment for State Hub retirement
@@ -79,7 +79,7 @@ Out of this workplan: SBOM catch-up (CUST-WP-0062 / ACTIVITY-WP-0030, parked).
 id: ACTIVITY-WP-0029-T01
 status: done
 priority: high
-state_hub_task_id: "03021be2-5d60-455b-9c9c-b8681d65911c"
+state_hub_task_id: "eef44f5f-1866-5539-adcf-661eeca2419b"
 ```
 
 Inventory schedules, sinks, and context resolvers that call State Hub or
@@ -95,7 +95,7 @@ Do not retarget a caller to activity-core just because we schedule it.
 id: ACTIVITY-WP-0029-T02
 status: done
 priority: high
-state_hub_task_id: "f8107e2b-ab1f-4a3b-9348-8d5dcfb647b4"
+state_hub_task_id: "13465801-fe1c-519c-935e-652376b6126a"
 ```
 
 Keep the activity-core schedule. Point the remote sweep at **repo-manager**
@@ -109,7 +109,7 @@ inside this repo.
 id: ACTIVITY-WP-0029-T03
 status: done
 priority: medium
-state_hub_task_id: "3fbadbfe-9107-4869-b53f-3b9b46e0555a"
+state_hub_task_id: "2d21912e-32af-5baa-b9f3-ec059d4aa69e"
 ```
 
 HUB-WP-0004 finished and hub-core became production authority on 2026-08-21.
@@ -135,7 +135,7 @@ projection.
 id: ACTIVITY-WP-0029-T04
 status: done
 priority: medium
-state_hub_task_id: "a34b42c3-8a08-482b-936f-14675ee254ca"
+state_hub_task_id: "fc67e34c-25a1-5c3a-9766-fb79c76aef00"
 ```
 
 Document the contract first, then replace State Hub `/execution/*` callers
diff --git a/workplans/ACTIVITY-WP-0030-daily-sbom-catchup.md b/workplans/ACTIVITY-WP-0030-daily-sbom-catchup.md
index 98e17ad..965ad22 100644
--- a/workplans/ACTIVITY-WP-0030-daily-sbom-catchup.md
+++ b/workplans/ACTIVITY-WP-0030-daily-sbom-catchup.md
@@ -14,7 +14,7 @@ related:
   - CUST-WP-0062
   - ACTIVITY-WP-0022
   - ADHOC-2026-06-01
-state_hub_workstream_id: "bfe2945e-38df-40d1-94d4-6e4a003ef66d"
+state_hub_workstream_id: "db3173ee-aaed-51dc-b674-af83f6a5f3fd"
 ---
 
 # Daily bounded SBOM catch-up via sbom-nexus
@@ -55,7 +55,7 @@ each. The replacement must ask sbom-nexus for **only N targets** and then
 id: ACTIVITY-WP-0030-T01
 status: done
 priority: high
-state_hub_task_id: "b216976e-5402-4e40-b282-78c5d021df72"
+state_hub_task_id: "745c9960-4c8b-5c1f-a8b2-a30db51a0364"
 ```
 
 Write `activity-definitions/daily-sbom-catchup.md` (`enabled: false` until
@@ -98,7 +98,7 @@ there is no live nexus yet and the definition stays `enabled: false`:
 id: ACTIVITY-WP-0030-T02
 status: done
 priority: high
-state_hub_task_id: "0d09c0d3-74bd-4f4d-8b27-5006ba010fa3"
+state_hub_task_id: "fb121cc1-bd1a-5ad3-82de-601b047ff628"
 ```
 
 Wait on CUST-WP-0062-T03. Bounded side-effect (SCOPE: declared purpose only):
@@ -120,7 +120,7 @@ success, skip, error, and at-most-N processing.
 id: ACTIVITY-WP-0030-T03
 status: done
 priority: high
-state_hub_task_id: "18bcfc21-616a-48a2-aac3-cdcef7579913"
+state_hub_task_id: "fa265eb9-8667-5e44-a78a-08693d20332f"
 ```
 
 Emergency containment began 2026-08-20 under ACTIVITY-WP-0031: set
@@ -140,7 +140,7 @@ active. Both production proof fires spawned zero tasks.
 id: ACTIVITY-WP-0030-T04
 status: done
 priority: medium
-state_hub_task_id: "f09144f6-c7f9-41d4-b466-d8a6288e6a21"
+state_hub_task_id: "6911e1f6-74fb-5179-8e15-4a9dc81b648b"
 ```
 
 Project the definition into `k8s/railiance/20-runtime.yaml`, sync schedules,